Skip to content

Commit 0c18019

Browse files
cappyzawacappyzawa
committed
Add mTLS support for git-based notifiers
Replace x509.CertPool with tls.Config across all Git-based notifiers (GitHub, GitLab, Gitea, Bitbucket, Azure DevOps, GitHub Dispatch) to enable mutual TLS authentication for enterprise environments. Adopt runtime/secrets AuthMethodsFromSecret for standardized handling of Bearer tokens, basic auth, and token auth while maintaining full backward compatibility with existing Secret formats. This unifies authentication processing across Git-based providers and adds mTLS capability without changing API surface or breaking existing deployments. Signed-off-by: cappyzawa <[email protected]>
1 parent 888412e commit 0c18019

19 files changed

+79
-76
lines changed

‎docs/spec/v1beta3/providers.md‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1197,13 +1197,20 @@ secure communication. The secret must be of type `kubernetes.io/tls` or `Opaque`
11971197

11981198
#### Providers supporting client certificate authentication
11991199

1200-
The following webhook-based providers support client certificate authentication:
1200+
The following providers support client certificate authentication:
12011201

12021202
| Provider Type | Description |
12031203
|---------------------|--------------------------------|
12041204
| `alertmanager` | Prometheus Alertmanager |
1205+
| `azuredevops` | Azure DevOps |
1206+
| `bitbucket` | Bitbucket |
1207+
| `bitbucketserver` | BitBucket Server/Data Center |
12051208
| `discord` | Discord webhooks |
12061209
| `forwarder` | Generic forwarder |
1210+
| `gitea` | Gitea |
1211+
| `github` | GitHub |
1212+
| `githubdispatch` | GitHub Dispatch |
1213+
| `gitlab` | GitLab |
12071214
| `grafana` | Grafana annotations API |
12081215
| `matrix` | Matrix rooms |
12091216
| `msteams` | Microsoft Teams |

‎go.mod‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,12 +18,12 @@ require (
1818
github.com/fluxcd/cli-utils v0.36.0-flux.14
1919
github.com/fluxcd/notification-controller/api v1.6.0
2020
github.com/fluxcd/pkg/apis/event v0.18.0
21-
github.com/fluxcd/pkg/apis/meta v1.17.0
21+
github.com/fluxcd/pkg/apis/meta v1.18.0
2222
github.com/fluxcd/pkg/auth v0.21.0
2323
github.com/fluxcd/pkg/cache v0.10.0
2424
github.com/fluxcd/pkg/git v0.34.0
2525
github.com/fluxcd/pkg/masktoken v0.7.0
26-
github.com/fluxcd/pkg/runtime v0.69.0
26+
github.com/fluxcd/pkg/runtime v0.74.0
2727
github.com/fluxcd/pkg/ssa v0.51.0
2828
github.com/fluxcd/pkg/ssh v0.20.0
2929
github.com/getsentry/sentry-go v0.34.1

‎go.sum‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -136,8 +136,8 @@ github.com/fluxcd/pkg/apis/event v0.18.0 h1:PNbWk9gvX8gMIi6VsJapnuDO+giLEeY+6olL
136136
github.com/fluxcd/pkg/apis/event v0.18.0/go.mod h1:7S/DGboLolfbZ6stO6dcDhG1SfkPWQ9foCULvbiYpiA=
137137
github.com/fluxcd/pkg/apis/kustomize v1.11.0 h1:0IzDgxZkc4v+5SDNCvgZhfwfkdkQLPXCner7TNaJFWE=
138138
github.com/fluxcd/pkg/apis/kustomize v1.11.0/go.mod h1:j302mJGDww8cn9qvMsRQ0LJ1HPAPs/IlX7CSsoJV7BI=
139-
github.com/fluxcd/pkg/apis/meta v1.17.0 h1:KVMDyJQj1NYCsppsFUkbJGMnKxsqJVpnKBFolHf/q8E=
140-
github.com/fluxcd/pkg/apis/meta v1.17.0/go.mod h1:97l3hTwBpJbXBY+wetNbqrUsvES8B1jGioKcBUxmqd8=
139+
github.com/fluxcd/pkg/apis/meta v1.18.0 h1:ACHrMIjlcioE9GKS7NGk62KX4NshqNewr8sBwMcXABs=
140+
github.com/fluxcd/pkg/apis/meta v1.18.0/go.mod h1:97l3hTwBpJbXBY+wetNbqrUsvES8B1jGioKcBUxmqd8=
141141
github.com/fluxcd/pkg/auth v0.21.0 h1:ckAQqP12wuptXEkMY18SQKWEY09m9e6yI0mEMsDV15M=
142142
github.com/fluxcd/pkg/auth v0.21.0/go.mod h1:MXmpsXT97c874HCw5hnfqFUP7TsG8/Ss1vFrk8JccfM=
143143
github.com/fluxcd/pkg/cache v0.10.0 h1:M+OGDM4da1cnz7q+sZSBtkBJHpiJsLnKVmR9OdMWxEY=
@@ -146,8 +146,8 @@ github.com/fluxcd/pkg/git v0.34.0 h1:qTViWkfpEDnjzySyKRKliqUeGj/DznqlkmPhaDNIsFY
146146
github.com/fluxcd/pkg/git v0.34.0/go.mod h1:F9Asm3MlLW4uZx3FF92+bqho+oktdMdnTn/QmXe56NE=
147147
github.com/fluxcd/pkg/masktoken v0.7.0 h1:pitmyOg2pUVdW+nn2Lk/xqm2TaA08uxvOC0ns3sz6bM=
148148
github.com/fluxcd/pkg/masktoken v0.7.0/go.mod h1:Lc1uoDjO1GY6+YdkK+ZqqBIBWquyV58nlSJ5S1N1IYU=
149-
github.com/fluxcd/pkg/runtime v0.69.0 h1:5gPY95NSFI34GlQTj0+NHjOFpirSwviCUb9bM09b5nA=
150-
github.com/fluxcd/pkg/runtime v0.69.0/go.mod h1:ug+pat+I4wfOBuCy2E/pLmBNd3kOOo4cP2jxnxefPwY=
149+
github.com/fluxcd/pkg/runtime v0.74.0 h1:4SxBWJSU6vKIrAoUHtaJ190pHyK445qlmIgG2XC5Tb0=
150+
github.com/fluxcd/pkg/runtime v0.74.0/go.mod h1:iGhdaEq+lMJQTJNAFEPOU4gUJ7kt3yeDcJPZy7O9IUw=
151151
github.com/fluxcd/pkg/ssa v0.51.0 h1:sFarxKZcS0J8sjq9qvs/r+1XiJqNgRodEiPjV75F8R4=
152152
github.com/fluxcd/pkg/ssa v0.51.0/go.mod h1:v+h9RC0JxWIqMTK2Eo+8Nh700AXyZChZ2TiLVj4tf3M=
153153
github.com/fluxcd/pkg/ssh v0.20.0 h1:Ak0laIYIc/L8lEfqls/LDWRW8wYPESGaravQsCRGLb8=

‎internal/notifier/azure_devops.go‎

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,6 @@ package notifier
1919
import (
2020
"context"
2121
"crypto/tls"
22-
"crypto/x509"
2322
"errors"
2423
"fmt"
2524
"strings"
@@ -51,10 +50,9 @@ type AzureDevOps struct {
5150

5251
// NewAzureDevOps creates and returns a new AzureDevOps notifier.
5352
func NewAzureDevOps(ctx context.Context, commitStatus string, addr string, token string,
54-
certPool *x509.CertPool, proxy, serviceAccountName, providerName, providerNamespace string,
53+
tlsConfig *tls.Config, proxy, serviceAccountName, providerName, providerNamespace string,
5554
tokenClient client.Client, tokenCache *cache.TokenCache) (*AzureDevOps, error) {
5655
var err error
57-
5856
if len(token) == 0 {
5957
// if token doesn't exist, try to create a new token using managed identity
6058
token, err = newManagedIdentityToken(ctx, proxy, serviceAccountName, providerName, providerNamespace, azure.ScopeDevOps, tokenClient, tokenCache)
@@ -83,10 +81,8 @@ func NewAzureDevOps(ctx context.Context, commitStatus string, addr string, token
8381

8482
orgURL := fmt.Sprintf("%v/%v", host, org)
8583
connection := azuredevops.NewPatConnection(orgURL, token)
86-
if certPool != nil {
87-
connection.TlsConfig = &tls.Config{
88-
RootCAs: certPool,
89-
}
84+
if tlsConfig != nil {
85+
connection.TlsConfig = tlsConfig
9086
}
9187
client := connection.GetClientByUrl(orgURL)
9288
gitClient := &git.ClientImpl{

‎internal/notifier/azure_devops_fuzz_test.go‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ package notifier
1818

1919
import (
2020
"context"
21+
"crypto/tls"
2122
"crypto/x509"
2223
"fmt"
2324
"io"
@@ -54,7 +55,8 @@ func Fuzz_AzureDevOps(f *testing.F) {
5455
var cert x509.CertPool
5556
_ = fuzz.NewConsumer(seed).GenerateStruct(&cert)
5657

57-
azureDevOps, err := NewAzureDevOps(context.TODO(), commitStatus, fmt.Sprintf("%s/%s", ts.URL, urlSuffix), token, &cert, "", "", "", "", nil, nil)
58+
tlsConfig := &tls.Config{RootCAs: &cert}
59+
azureDevOps, err := NewAzureDevOps(context.TODO(), commitStatus, fmt.Sprintf("%s/%s", ts.URL, urlSuffix), token, tlsConfig, "", "", "", "", nil, nil)
5860
if err != nil {
5961
return
6062
}

‎internal/notifier/bitbucket.go‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,6 @@ package notifier
1919
import (
2020
"context"
2121
"crypto/tls"
22-
"crypto/x509"
2322
"encoding/json"
2423
"errors"
2524
"fmt"
@@ -41,7 +40,7 @@ type Bitbucket struct {
4140
}
4241

4342
// NewBitbucket creates and returns a new Bitbucket notifier.
44-
func NewBitbucket(commitStatus string, addr string, token string, certPool *x509.CertPool) (*Bitbucket, error) {
43+
func NewBitbucket(commitStatus string, addr string, token string, tlsConfig *tls.Config) (*Bitbucket, error) {
4544
if len(token) == 0 {
4645
return nil, errors.New("bitbucket token cannot be empty")
4746
}
@@ -71,11 +70,9 @@ func NewBitbucket(commitStatus string, addr string, token string, certPool *x509
7170
repo := comp[1]
7271

7372
client := bitbucket.NewBasicAuth(username, password)
74-
if certPool != nil {
73+
if tlsConfig != nil {
7574
tr := &http.Transport{
76-
TLSClientConfig: &tls.Config{
77-
RootCAs: certPool,
78-
},
75+
TLSClientConfig: tlsConfig,
7976
}
8077
hc := &http.Client{Transport: tr}
8178
client.HttpClient = hc

‎internal/notifier/bitbucket_fuzz_test.go‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ package notifier
1818

1919
import (
2020
"context"
21+
"crypto/tls"
2122
"crypto/x509"
2223
"fmt"
2324
"io"
@@ -45,7 +46,8 @@ func Fuzz_Bitbucket(f *testing.F) {
4546
var cert x509.CertPool
4647
_ = fuzz.NewConsumer(seed).GenerateStruct(&cert)
4748

48-
bitbucket, err := NewBitbucket(commitStatus, fmt.Sprintf("%s/%s", ts.URL, urlSuffix), token, &cert)
49+
tlsConfig := &tls.Config{RootCAs: &cert}
50+
bitbucket, err := NewBitbucket(commitStatus, fmt.Sprintf("%s/%s", ts.URL, urlSuffix), token, tlsConfig)
4951
if err != nil {
5052
return
5153
}

‎internal/notifier/bitbucketserver.go‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,6 @@ import (
2020
"bytes"
2121
"context"
2222
"crypto/tls"
23-
"crypto/x509"
2423
"encoding/json"
2524
"errors"
2625
"fmt"
@@ -81,7 +80,7 @@ type bbServerBuildStatusSetRequest struct {
8180
}
8281

8382
// NewBitbucketServer creates and returns a new BitbucketServer notifier.
84-
func NewBitbucketServer(commitStatus string, addr string, token string, certPool *x509.CertPool, username string, password string) (*BitbucketServer, error) {
83+
func NewBitbucketServer(commitStatus string, addr string, token string, tlsConfig *tls.Config, username string, password string) (*BitbucketServer, error) {
8584
url, err := parseBitbucketServerGitAddress(addr)
8685
if err != nil {
8786
return nil, err
@@ -93,11 +92,9 @@ func NewBitbucketServer(commitStatus string, addr string, token string, certPool
9392
}
9493

9594
httpClient := retryablehttp.NewClient()
96-
if certPool != nil {
95+
if tlsConfig != nil {
9796
httpClient.HTTPClient.Transport = &http.Transport{
98-
TLSClientConfig: &tls.Config{
99-
RootCAs: certPool,
100-
},
97+
TLSClientConfig: tlsConfig,
10198
}
10299
}
103100

‎internal/notifier/factory.go‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -318,40 +318,40 @@ func gitHubNotifierFunc(opts notifierOptions) (Interface, error) {
318318
if opts.Token == "" && opts.Password != "" {
319319
opts.Token = opts.Password
320320
}
321-
return NewGitHub(opts.CommitStatus, opts.URL, opts.Token, opts.CertPool, opts.ProxyURL, opts.ProviderName, opts.ProviderNamespace, opts.SecretData, opts.TokenCache)
321+
return NewGitHub(opts.CommitStatus, opts.URL, opts.Token, opts.TLSConfig, opts.ProxyURL, opts.ProviderName, opts.ProviderNamespace, opts.SecretData, opts.TokenCache)
322322
}
323323

324324
func gitHubDispatchNotifierFunc(opts notifierOptions) (Interface, error) {
325325
if opts.Token == "" && opts.Password != "" {
326326
opts.Token = opts.Password
327327
}
328-
return NewGitHubDispatch(opts.URL, opts.Token, opts.CertPool, opts.ProxyURL, opts.ProviderName, opts.ProviderNamespace, opts.SecretData, opts.TokenCache)
328+
return NewGitHubDispatch(opts.URL, opts.Token, opts.TLSConfig, opts.ProxyURL, opts.ProviderName, opts.ProviderNamespace, opts.SecretData, opts.TokenCache)
329329
}
330330

331331
func gitLabNotifierFunc(opts notifierOptions) (Interface, error) {
332332
if opts.Token == "" && opts.Password != "" {
333333
opts.Token = opts.Password
334334
}
335-
return NewGitLab(opts.CommitStatus, opts.URL, opts.Token, opts.CertPool)
335+
return NewGitLab(opts.CommitStatus, opts.URL, opts.Token, opts.TLSConfig)
336336
}
337337

338338
func giteaNotifierFunc(opts notifierOptions) (Interface, error) {
339339
if opts.Token == "" && opts.Password != "" {
340340
opts.Token = opts.Password
341341
}
342-
return NewGitea(opts.CommitStatus, opts.URL, opts.ProxyURL, opts.Token, opts.CertPool)
342+
return NewGitea(opts.CommitStatus, opts.URL, opts.ProxyURL, opts.Token, opts.TLSConfig)
343343
}
344344

345345
func bitbucketServerNotifierFunc(opts notifierOptions) (Interface, error) {
346-
return NewBitbucketServer(opts.CommitStatus, opts.URL, opts.Token, opts.CertPool, opts.Username, opts.Password)
346+
return NewBitbucketServer(opts.CommitStatus, opts.URL, opts.Token, opts.TLSConfig, opts.Username, opts.Password)
347347
}
348348

349349
func bitbucketNotifierFunc(opts notifierOptions) (Interface, error) {
350-
return NewBitbucket(opts.CommitStatus, opts.URL, opts.Token, opts.CertPool)
350+
return NewBitbucket(opts.CommitStatus, opts.URL, opts.Token, opts.TLSConfig)
351351
}
352352

353353
func azureDevOpsNotifierFunc(opts notifierOptions) (Interface, error) {
354354
return NewAzureDevOps(opts.Context, opts.CommitStatus, opts.URL, opts.Token,
355-
opts.CertPool, opts.ProxyURL, opts.ServiceAccountName, opts.ProviderName,
355+
opts.TLSConfig, opts.ProxyURL, opts.ServiceAccountName, opts.ProviderName,
356356
opts.ProviderNamespace, opts.TokenClient, opts.TokenCache)
357357
}

‎internal/notifier/gitea.go‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,6 @@ package notifier
1919
import (
2020
"context"
2121
"crypto/tls"
22-
"crypto/x509"
2322
"errors"
2423
"fmt"
2524
"net/http"
@@ -45,7 +44,7 @@ type Gitea struct {
4544

4645
var _ Interface = &Gitea{}
4746

48-
func NewGitea(commitStatus string, addr string, proxyURL string, token string, certPool *x509.CertPool) (*Gitea, error) {
47+
func NewGitea(commitStatus string, addr string, proxyURL string, token string, tlsConfig *tls.Config) (*Gitea, error) {
4948
if len(token) == 0 {
5049
return nil, errors.New("gitea token cannot be empty")
5150
}
@@ -70,10 +69,8 @@ func NewGitea(commitStatus string, addr string, proxyURL string, token string, c
7069
}
7170

7271
tr := &http.Transport{}
73-
if certPool != nil {
74-
tr.TLSClientConfig = &tls.Config{
75-
RootCAs: certPool,
76-
}
72+
if tlsConfig != nil {
73+
tr.TLSClientConfig = tlsConfig
7774
}
7875

7976
if proxyURL != "" {

0 commit comments

Comments
 (0)